Executive brief
Linux kernel's zram (compressed RAM) block device driver contains a race condition in the read_block_state() function that can cause out-of-bounds memory access. If a zram device is reconfigured with a smaller size while this function is executing, the function may access memory locations beyond the newly allocated table, potentially causing a kernel crash or system instability.
Technical details
The vulnerability is a race condition (CWE-362) in the zram_drv.c read_block_state() function. The function initially reads the zram device's disksize without holding the dev_lock, calculates nr_pages from this value, and then acquires the lock. If the device is reset and reinitialized with a smaller disksize between the initial read and lock acquisition, the nr_pages variable becomes stale and describes the old table. The subsequent loop then calls slot_lock() using this stale index, potentially accessing memory beyond the bounds of the newly allocated table. The fix moves the disksize read to occur after acquiring dev_lock and verifying device initialization, ensuring the value remains stable throughout the scan. Local privilege or access to sysfs zram device files is required to trigger this condition.
Affected products
- Linux Linux Kernel Multiple versions (see stable backports)
Timeline
- 2026-09-11: disclosed
- 2026-08-24: patched: Upstream patch committed by Andrew Morton
- 2026-09-07: patched: Backport to stable trees by Greg Kroah-Hartman